Category: Registry

RMM Automation: Modify the Registry for All Users

As our business continues to focus on providing white labeled Tier 3 IT support services, RMM as a service, and co-managed IT services this blog will be highlighting tips for RMM automation. Here is one of the recent scripts we added to our RMM. We often find ourselves wanting to modify the registry for all users:

Variables

It is important to not store variables in scripts especially when they are credentials for a user on the local computer, so make sure to define variables accordingly. In this script there are no variables like that, but wanted to explain some that are in the script:

$PatternSID = this is the Regular Expression pattern for the Security ID of the users to look for (found it was different for local / domain vs. Azure)
$ProfileList = List of SIDs and other information from the HKLM folders
$LoadedHives = List of logged in users from HKU
$UnloadedHives = List of not logged in users from HKU

Script Snippet

# Regex pattern for Local or Domain SIDs
$PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
 
# Get Username, SID, and location of ntuser.dat for all users
$ProfileList = gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} | 
    Select  @{name="SID";expression={$_.PSChildName}}, 
            @{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}}, 
            @{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}}
 
# Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded)
$LoadedHives = gci Registry::HKEY_USERS | ? {$_.PSChildname -match $PatternSID} | Select @{name="SID";expression={$_.PSChildName}}
 
# Get all users that are not currently logged
$UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select @{name="SID";expression={$_.InputObject}}, UserHive, Username
 
# Loop through each profile on the machine
Foreach ($item in $ProfileList) {
    # Load User ntuser.dat if it's not already loaded
    IF ($item.SID -in $UnloadedHives.SID) {
        reg load HKU\$($Item.SID) $($Item.UserHive) | Out-Null
    }
 
    #####################################################################
    # This is where you can read/modify a users portion of the registry 

    # This example checks for a key, adds it if missing, and creates / changes a DWORD in that key
    "{0}" -f $($item.Username) | Write-Output
    If (!(Test-Path registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement)) {
	    New-Item -Path registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement -Force | Out-Null
	}
    Set-ItemProperty registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement -Name “ScoobeSystemSettingEnabled” -Value “0” -Type DWord 
    
    #####################################################################
 
    # Unload ntuser.dat        
    IF ($item.SID -in $UnloadedHives.SID) {
        ### Garbage collection and closing of ntuser.dat ###
        [gc]::Collect()
        reg unload HKU\$($Item.SID) | Out-Null
    }
}
# Regex pattern for AzureAD SIDs
$PatternSID = 'S-1-12-1-\d+-\d+\-\d+\-\d+$'
 
# Get Username, SID, and location of ntuser.dat for all users
$ProfileList = gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} | 
    Select  @{name="SID";expression={$_.PSChildName}}, 
            @{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}}, 
            @{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}}
 
# Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded)
$LoadedHives = gci Registry::HKEY_USERS | ? {$_.PSChildname -match $PatternSID} | Select @{name="SID";expression={$_.PSChildName}}
 
# Get all users that are not currently logged
$UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select @{name="SID";expression={$_.InputObject}}, UserHive, Username
 
# Loop through each profile on the machine
Foreach ($item in $ProfileList) {
    # Load User ntuser.dat if it's not already loaded
    IF ($item.SID -in $UnloadedHives.SID) {
        reg load HKU\$($Item.SID) $($Item.UserHive) | Out-Null
    }
 
    #####################################################################
    # This is where you can read/modify a users portion of the registry 
 
    # This example checks for a key, adds it if missing, and creates / changes a DWORD in that key
    "{0}" -f $($item.Username) | Write-Output
    If (!(Test-Path registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement)) {
	    New-Item -Path registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement -Force | Out-Null
	}
    Set-ItemProperty registry::HKEY_USERS\$($Item.SID)\SOFTWARE\Microsoft\Windows\CurrentVersion\UserProfileEngagement -Name “ScoobeSystemSettingEnabled” -Value “0” -Type DWord 
    
    #####################################################################
 
    # Unload ntuser.dat        
    IF ($item.SID -in $UnloadedHives.SID) {
        ### Garbage collection and closing of ntuser.dat ###
        [gc]::Collect()
        reg unload HKU\$($Item.SID) | Out-Null
    }
}

Checking whether each item already exists helps the RMM to get the proper exit code and not show the script as failed when run.

If your company is a MSP or wants to become one and automation just seems out of reach, then contact us to run your RMM for you.

Your roaming profile was not completely synchronized error on Windows 10

Had a client receive the message “There was a problem with your roaming profile…” after logging into another computer on the domain. Research and found that a simple registry fix was available, but most fixes wanted admins to export a key from another working profile then import it into the broken one. Here is the actual registry key that was used to fix the profile:

Registry Fix for roaming profile was not completely synchronized

Open Registry Editor as the broken user and NOT administrator
Navigate to HKCU > SOFTWARE > Microsoft > Windows NT > CurrentVersion > Winlogon
Right click and choose New > String Value and give it the name ExcludeProfileDirs
Enter the following – AppData\Local;AppData\LocalLow;$Recycle.Bin;OneDrive;Work Folders
Logout and back in to test.

Network Drives Disconnect

Had a client that repeatedly had troubles with network drives disconnect happening randomly. I did explain that this would happen normally if they kept their workstations logged into the server, but they did not want to change their habits. I performed the usual registry fixes on the workstations and the server, but these did not seem to work. Finally I got to look at the error and figured out the Group Policy Object that was causing the problem.

Usual Registry Fix:

The default method for this is to edit the registry as follows on both and run a command on the server to lengthen the disconnect time on the workstations and disable disconnect on the server.

Workstations:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters
In the right pane, click the KeepConn value, and then on the Edit menu, click Modify. If the KeepConn value does not exist, follow these steps:
1. On the Edit menu, point to New, and then click REG_DWORD.
2. Type KeepConn, and then press ENTER.
On the Edit menu, click Modify.
Click Hexadecimal.
In the Value data box, type ffff, and then click OK.

Server:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
In the right pane, click the autodisconnect value, and then on the Edit menu, click Modify. If the autodisconnect value does not exist, follow these steps:
1. On the Edit menu, point to New, and then click REG_DWORD.
2. Type autodisconnect, and then press ENTER.
On the Edit menu, click Modify.
Click Decimal.
In the Value data box, type 0, and then click OK.

Finally the following command should also be run:

net config server /autodisconnect:-1

Group Policy Object Fix:

Even though I changed the systems as above, it still disconnected regularly. The clients were getting this message when disconnected -“The system has detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you.” Some research found that Windows Small Business Server created a Group Policy Object that by default times out authentication to the server after 10 hours. Here is how I changed it:

Open Group Policy Management
Look for Default Domain Policy
Click on the Settings tab and then Show All
Under Account Policies/Kerberos Policy look for Maximum lifetime for user ticket which by default was 10 hours.
Right click on the policy and choose Edit
Dig down to Computer Configuration > Windows Settings > Security Settings > Account Policies > Kerberos Policy
Change the Maximum lifetime for user ticket to 100 hours (>4 days)
Change the Maximum lifetime for user ticket renewal to 4 days

This combination will keep the ticket lifetime timeout longer than the time for renewal which will cause the renewal to happen before the timeout. Problem solved.

If your company is having issues with Network Drive Disconnect, then contact us for assistance.

Issues After Office 365 Migration

Keep running into this issue at client sites where an on-premise Microsoft Exchange Server (especially from Microsoft SBS Server) to Office 365 migration has taken place. Client workstations are unable to connect to Office 365 servers via Autodiscover for their migrated email accounts. During Outlook first run it would pre-populate their email correctly but then try to connect to the old email server instead. If the DNS settings for the workstation were changed to non-domain external DNS servers then the email would not pre-populate but the setup would complete successfully. Checked the Autodiscover URL using NSLOOKUP to the Microsoft servers from local domain DNS servers successfully, so felt a little stumpled. Research pointed to the Service Connection Point (SCP) object in Active Directory which can be either deleted from the server or excluded on a per workstation basis, so both will be shown here. Starting with the server first:

Deleting SCP from Server after Office 365 Migration

Login to a server with Active Directory Domain Services installed as administrator
Launch ADSIedit from the Start Menu
Right click on the root of the console and choose “Connect to…”
Under “Select a well know Naming Context” choose Configuration
Navigate down through the tree as follows (these are always listed from the bottom up on other tech sites for some reason):

CN=Autodiscover,CN=Protocols,CN=,CN=Servers,CN=Exchange Administrative Group,CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services
Delete the entire CN=Autodiscover object if you no longer have any on-premise Exchange Servers
Reboot the workstation to clear the DNS / AD cache and try to connect to Office 365 servers again

Deleting SCP from Workstation after Office 365 Migration

Lauch Regedit from the Start Menu
Navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Next navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Reboot the workstation to effect the Registry changes and try to connect to Office 365 servers again

If your organization needs any help with troubleshooting issues with Office 365 or with migrating from on-premise Microsoft Exchange Server, then don’t hesitate to contact us for support.

Terminal Server Lockdown Group Policy

Recently have had to setup a couple terminal servers and wanted to create a list of standard lock downs that can be added via a Terminal Server lockdown Group Policy Object (GPO).

Terminal Server Lockdown Preparation

1. Open Active Directory Users & Computers
2. Create Organizational Unit (OU) for Terminal Server.
3. Move all terminal servers to this OU.
4. Create Security Group in this OU for users who will use Remote Desktop Host (i.e. Terminal Server Users).
5. Add all users who will use the terminal server as members of this security group. 6. Open Group Policy Management, right click the new Terminal Server OU and “Create a GPO in this domain, and Link it here” (i.e. Terminal Server Lock Down).
7. In Security Filtering delete Authenticated Users, add Terminal Server Users security group created in previous step.

Configure users who can connect to the server remotely:

1. Log into the terminal Server
2. Open Control Panel, open System, click on Remote Settings then click on the Remote tab.
3. Click on Select Users, Remove any groups/users and then Add the Terminal Server Users security group.

Disable Server Manager Pop Up at user log on:

1. On Terminal Server open Task Scheduler.
2. Navigate to Task Scheduler Library\Microsoft\Windows\Server Manager.
3. Disable task “ServerManager” which triggers at log on of any user.

Configure Group Policy for Terminal Server Lock Down:

Loopback Processing:

[Computer Configuration\Policies\Administrative Templates\System\Group Policy]

Configure user Group Policy loopback processing mode: Enable – Merge

Disable Control Panel Items:

[User Configuration\Policies\Administrative Templates\Control Panel]

Hide specified Control Panel items: Enable

Add following items to the disallowed Control Panel items:
Microsoft.AdministrativeTools
Microsoft.AutoPlay
Microsoft.ActionCenter
Microsoft.ColorManagement
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.iSCSIInitiator
Microsoft.NetworkAndSharingCenter
Microsoft.NotificationAreaIcons
Microsoft.PhoneAndModem
Microsoft.PowerOptions
Microsoft.ProgramsAndFeatures
Microsoft.System
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WindowsFirewall
Microsoft.WindowsUpdate
Microsoft.DateAndTime
Microsoft.RegionAndLanguage
Microsoft.RemoteAppAndDesktopConnections
Install Application On Remote Desktop Server
Java
Flash Player

Remove Administrative Tools and Powershell:

Restrict access to Administrative tools:

1. Navigate to:

[Computer Configuration\Policies\Windows Settings\Security Settings]

2. Right click on File System, choose Add File… .
3. In the Add a file or folder window, type the following in the Folder field and click OK:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Terminal Server Lockdown - Folder Security Settings
4. On the next window, Database Security, remove Users and check that Administrators have Full Access.
Database Security for Server Manager.lnk
5. On the Add Object window choose Configure this file or folder then Propagate inheritable permissions to all subfolders and files then click OK.
Terminal Server Lockdown - Add Object
6. Repeat the above steps for the PowerShell shortcut (in addition delete Creator Owner in database security):

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk

7. Repeat the above steps for the Server Manager shortcut:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk

File Explorer Configuration:

[User Configuration\Policies\Administrative Templates\Windows Components\File Explorer]

Enable – Restrict A, B, C and D drives only: Hide these specified drives in My Computer

Enable – Remove Hardware tab

Enable – Hides the Manage item on the File Explorer context menu

Enable – Remove Security tab

Disable Registry Modification:

[User Configuration\Policies\Administrative Templates\System]

Enable – Prevent access to registry editing tools

Configure Windows Installer and Windows Updates:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer]

Enable: Prevent users from using Windows Installer to install updates and upgrades

Enable Always: Turn off Windows Installer

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

Disable: Allow non-administrators to receive update notifications

Additional Policies:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits]

Enable (i.e. 30 minutes): Set time limit for disconnected sessions

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for logoff of RemoteApp sessions: Enable (i.e. logoff delay 1 hour)

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for active but idle Remote Desktop Services sessions: Enable ( i.e. 1 hour)

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Go to the desktop instead of Start when signing in or when all the apps on a screen are closed: Enable

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Remove the Action Center icon: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/Windows Update]

Remove access to use all Windows Update features: Enable (0 = Do not show any notifications)

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Remove CD Burning features: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Prevent access to drives from My Computer: Enable (choose the drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Credentials User Interface]

Do not display the password reveal button: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/AutoPlay Policies]

Turn off Autoplay: Enable (CD-ROM and removable media drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection]

Do not allow passwords to be saved: Enable

For detailed explanations of what each of these items does please see the notes in each individual Group Policy setting.

Corrupt User Profile

Had a client that allows a third party bookkeeper to login remotely to one of their workstations where their accounting software is installed. This user expressed that “all of a sudden” they were unable to see any desktop icons or work with the Start menu properly. Once remotely connected into the system with the bookkeeper found an error message that access to the redirected desktop was denied. Tried changing permissions on the Desktop folder, tried renaming the folder and letting a fresh login recreate them on the server, and tried renaming the local profile folder then another login to recreate those as well. Then I finally remembered the solution – it was a corrupt user profile in the registry:
z

Registry Edit to fix Corrupt User Profile Issues

HKLM\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\ProfileList

Remember to look through this list and find the user in question, export the key (aka backup) and then remove the entire folder containing their profile. One more reboot and login fixed the issue successfully. Thanks to following Microsoft TechNet Article for the details on the fix.
If your company is using remote access or have issues with a corrupt user profile, then contact us for assistance.